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NATIONAL SECURITY AGENCY 
CENTRAL SECURITY SERVICE 
FORT GEORGE G. MEADE MARYLAND 20755-6000 


4 March 2013 

MEMORANDUM FOR THE CHAIRMAN, INTELLIGENCE OVERSIGHT BOARD 

THRU: Assistant to the Secretary of Defense (Intelligence Oversight) 

SUBJECT: (U//F0t}O) Report to the Intelligence Oversight Board on NSA Activities - 
INFORMATION MEMORANDUM 

(U/ /I OUO) Except as previously reported to you or the President, or otherwise stated in the 
enclosure, we have no reason to believe that intelligence activities of the National Security Agency during 
the quarter ending 31 December 2012 were unlawful or contrary to Executive Order or Presidential 
Directive and thus should have been reported pursuant to Section 1.6(c) of Executive Order 12333, as 
amended. 

(U//TT)IJ(>) The Inspector General and the General Counsel continue to exercise oversight of 
Agency activities by inspections, surveys, training, review of directives and guidelines, and advice and 
counsel. 


GEORGE BLLARD 


Inspector General 


RAJESH DE 
General Counsel 


(U// FOUG ) 1 concur in the report of the Inspector General and the General Counsel and hereby 
make it our combined report. 


KEITH a. ALEXANDER 
General, U. S. Army 
Director. NSA/Chief, CSS 


Enel: 

Quarterly Report 


This document may be declassified and marked 
“UNCLASS1RED/ /1 ui Official Use On l y 1 
upon removal of enclosure(s) 


roved for Release bv NSA on 12-19-2014. FOIA Case # 70809 
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I. (U) Intelligence, Counterintelligence, and Intelligence-Related Activities that 
Violated Law, Regulation, or Policy and Were Substantiated during the 
Quarter, as well as Actions Taken as a Result of the Violations 

I.A. (U) Intelligence Activities Conducted under Executive Order (E.O.) 12333 
Authority 

(U//FOUO) Some incidents may involve more than one authority (e g.. E.O 12333, 
NSA/CSS Title I Foreign Intelligence Surveillance Act (FISA). FISA Amendments Act (FAA). 
Incidents involving more than one authority are included in the section for each involved 
authority. Thus, a single incident may produce multiple entries in this report, !k! !^! 


(b)(1) 

(b) (3)-P.L. 86-36 
(b)(3)-50 USC 3024(i) 


(b)(3)-50 USC 3024(i) 

I.A. 1 (U) Unintentional Targeting or Database Queries against United States 
Persons (USPs) or Foreign Persons in the United States 

(S//S I “R Et "TO'tl'S A. PVPY; During the fourth quarter of calendar year 2012 (CY2012). 
the National Security Auency/Central Secu rity Service (NSA/CSS) continued [ 1 

I ~] As part of that process, duplicate selectors were 

removed and the number of active selectors was reduced At the end of the fourth quarter of 
CY20I2. NS A/CSS's prima ry tasking tools for telephone and Internet selectors contained 
approximately |active selectors. 

. . .-.(b) (3)-P.L. 86-36 

(U//POUO) During the fourth quarter ofCY2012. in | [ instances, signals intelligence 
(S1GINT) analysts inadvertently targeted communications to. from, or about USPs. while 
pursuing foreign intelligence tasking or performed mistaken queries that potentially sought or 
returned information about USPs. Unless otherwise specified, all intercepts, query results, and 
reports have been deleted or destroyed as required by United States S1GINT Directive SP0018. 

I.A. 1 a. (U) Tasking Errors 

(TS//S I //REL TO USA. FVE¥) | an analyst discovered that selectors 

associated with a USP had erroneously been tasked because the analyst had overlooked 
information about the target’s USP status. All selectors associated with the target were detasked. 
and all collected data was purged. 


(TS//SI//REL TO USA. FVEY) | | an analyst discovered that a selector 

for a foreign intelligence target that had been detasked was subse quently retasked whi le, the 
target was in the United States. The analyst detasked the selector | 1 \ \\_ 


(b) (1) 

(b) (3)-P.L. 86-36 


(S//S1//RCL TO USA. FVE¥) 1 I analysts discovered that 

selectors associated with foreign in telliuence targets that had been previously detasked because 

| were retasked while the targets were in the United States. All 
selectors were detasked and no collection occurred 

(TS//S17NF) | t in analyst discovered that | [ selectors associated 

with a USP had been erroneously tasked because information about the target’s USP status was 

Deriv ed From: NSA/CSSM 1-52, dated 20080107 
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(b)(1) 

(b)(3)-P.L. 86-36 
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(b)(1) 

(.b) (3)-P.L. 86-36 
(bj\(3) -50 USC 3024 (i) 


not provided by an Intelligence Community (IC) customer when the selecto r was being 
researched for tasking. The selector was detasked. and all data was deleted 


(TS//SI/TK//RCL TO U3A. rVCp f 


jwere erroneously targeted and collection occurred for 39 minutes 

because a 


before executing the collection task. All collected data was purged 

(b)(1) 

(b)(3)-P.L. 86-36 


(TS//SI//RCL TO USA. fVEY) 


an analyst mistakenly requested 


tasking of his own personal identifier instead of the selector associat ed with a foreign 
intelligence target. The selector was detasked I 


I.A.I.a.i. (U) Unauthorized Targeting 
(Tiv s i r ^ r rl ~1 


(b) (1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 USC 3024(i) 


an analyst discovered that a telephone selector 


associated with a USP. fo rmerly app roved for targeting un der a | 

The selector was detasked l I 


was tasked 


_A destruction waiver has been requested, and a request for FAA §704 

(bid ) authorization has been submitted for future targeting. 

(b)(3)-P.L. 86-36 e c 


(TS//S 1 //NF) 


United States. 




I an analyst discovered that data had been collected 
the selector for a foreign intelligence target when the target was in the 


I.A.I.b. (U) Database Queries 

gm to usa, rvuvi f 


(b) (1) 

(b)(3)-P.L. 86-36 
(b)(3)—50 USC 3024 (i) 



(U/. TOUO q On | | occasions during the fourth quarter, analysts performed overly broad 

or poorly constructed data base queries that potentially selected or returned informatio n about 
USPs. These queries used 


_that produced imprecise 

results. Onj |of those occasions, the queries returned results, which were deleted or aged off. 


as required, and no reports were issued. Analysts who performed these queries were counseled 
by their management. 


(U) Procedural and other errors contributed to the following incidents: 


(b)(3)-P.L. 86-36 


(S//SI//REL TO USA. TVOY) On | [ occasions during the fourth quarter. NS A analysts 
performed queries in raw traffic databases without first conducting the necessary research 


'(b)(1) 

(b)(3)-P.L. 86-36 
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on the selectors. When the queries returned results, they were deleted and no reports were 
issued. 


(TS//S1//REL TO USA. FVF rf While performin’’ a query on a selector for a foreign 
intelligence target 


| NSA had detasked the selector because the target was in the United States. The 
query results were deleted | 1 - . (b)( 1 ) 


(S//S1//RCL TO USA. FVE T 
traffic database 


(b) (3)-P.L. 86-36 

an analyst performed a query in a raw 


No results were returned. 


'(b)-1 1) 

Wt3)-P.L. 86-36 
(b)(3)-50 USC 3024(i) 



(S//SI//REL TO USA. TVEY) [ 


analyst had mistaken ly performed | | q 

; Unite* 

36-36 


] a database auditor discovered that an 


ueries in a raw traffic database on the selectors for 
a foreign intelligence target in the United States. The analyst deleted the results. 

(S//S1/ REL TO USA. FVEY )[ 


traffic database on a selector that had been determined 


a n analyst performed a 


query in a raw 
Ito be associated 


with a USP. The analyst deleted the query and results!" 


"In a raw traffic database on selectors associated 

with a target when it was 

known that 

Ithe United States 





(S/ Sl/ REL TO USA. PVCT T 
selector associated with a USP 


an analyst performed a query using a 


The analyst then sent the results 


J 


of the query to another analyst. Subsequently, the analyst learned that the selector was 
registered to a USP. The analyst recalled the e-mail and deleted all query results. 

(TS//SI//NF ) | | analysts selected an incorrect 


database when performing queries on selectors associated with foreign intelligence targets. 
No results were returned. 

86-36 


(TS//S1 WFt 


] a database auditor discovered that an analyst had 


mistakenly pe rformed a query on a target authorized under FAA $705(b)[ 


| _J raw tra ff> c data base during the time the targe t was in the United States. The 

query and results were deleted | 


(b)(1) 

(b)(3J-P.L. 86-36 
(b)(3)-50 USC 3024(i) 
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(S//SI//REL TO USA. r\TY) |_| an analyst discovered that a query was 

performed on a selector associated with a foreign intelligence target while the target was in 
the United States. 


Tb)(i) 

(b)(3)-P.L. 


1 in a raw traffic database on one of the selectors for a foreign 

intelligence target who arrived in the United States l I The analyst was 

because of database access problems. The 

3 £iqsplts were deleted | I 

• (S//S1//REL TO USA. rVPr f j an analyst performed a query in the 

incorrect raw S1GINT database. The query and the results were deleted immediately. 

• ~(S "S 1 Rfl TO USA. REV) an analyst unfamiliar with a query 

tool performed a query in a raw traffic database | ..J 

No results were returned. „ ' 


vV --E V E V- ) On thr ee occasions[ 
analysts discovered! 


(b)(3)-P.L. 86-36 
(b)(3)-50 USC 3024(i! 


m U) 

(b)(3)-P.L. 


I |the selectors associated with foreign intel ligence targets were detasked 

::'::beeause | | the United States. [" 

I^iults were deleted. 

(S//3I//REL TO USA. FVEY) | | an analyst performed a query in a 

raw traffic database on a list of selectors that included one associated with a USP. Upon 
discovery of the error, the analyst stopped the query and removed the selector. 

(S//SI//F.EL TO USA. EVEY) | | an analyst included a U S. e-mail 

address instead of the intended target's e-mail address in a query running in a raw traffic 
database. No results were returned. 


traffic database | 

the results without viewing them 


Jan analyst perfor med a query in a raw 
| The analyst deleted 


—(TG//3I//NF)|_| an analyst performed a query in a ra w traffic databas e 

on a se lector associated with a USP A destruction waiver was approved I j 


• (S " SI " REL TO U S A. EVE¥) | | an analyst ran a query in a raw 

traffic database on the selectors associated with a foreign intelligen ce target while the target 
was in the United States. The analyst deleted the query and results_ 

• (3//31//REL TO USA. TVEY) ~| an analyst performed a query in a 

raw traffic database on the incorrect selector because| 

into the query form. The query was canceled before execution, and no results were 
returned 

. "(b) (1) 

(b) (1) (b) (3)-P.L. 86-36 

(b) (3)-P.L. 86-36 (b) (3)-50 USC 3024(i) 
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(b) (1) 

(b)(3)-P.L. 86-36 
(b) (3)-18 USC 798 
(b) (3)-50 USC 3024 (i) 


I.A.I.c. (U) Detasking Delays 

(S//SI//REL TO USA. EVEY) A selector associated with a foreign intelligence target 


The delay occurred because 


occurred. 


J No collection 


it was discovered that selectors 


(S//SI//REL TO USA. FVEY )|_ 

fot | | foreign intelligence targets had been overlooked tor detasking and remained on task. 
Upon discovery, the selectors were detasked. 


(S/ZSIZ/ftEt - TQ - USA. rVTY) | I during a selector r eview, an analys t 

noticed that a selector for a foreign intelligence target that had been detasked [ | 

| | The selector was detasked (b) (1) 


(S//S 1 //REL T - 0 - U S A. FVEY) 


(b)(3)-P.L. 86-36 

Jwhen retasking a selector for a 


foreign intelligence target, an analyst discovered that the selector had remained on task while the 
target was in the United States. No collection occurred during the time the target was in the 
United States. 


(S//31//RCL TO USA. F Y E Y )[ 


it was discovered that selectors for a 


a eign intelligence target had remained on task d espite information 
he United States. All selectors were detasked 


(S//S 1 //R E L TO USA. FY E Y )[ 


a foreign intelligence target had been overlooked when 


|an analyst learned that a selector for 


The selector was detasked 


J 


(TS//S I //RCL TO USA. TVCY) Selectors for a foreign intelligence target remained on 
task | | aftei NSA analysts had detasked the 

selectors because the target had entered the United States ( No reports were 

.lillii::!::!.".*.. 

) (l) issued. 

)(3)-P.L. 86-36 

(S SI RCL TO USA. r\ t E YT 
foreign intelligence target^ 


remained on ta sk despite the submis sion of a detask request 
were detasked | and data was purged 


__, analysts learned that selectors for a 

|he United States! ~ 


]had 


The selectors 

.. ( 1 ) 

(b)(3)-P.L. 86-36 


(S//S1//REL TO USA - FVT-¥) [ 


remained on task for a foreign intelligence tanzet 


1 an analy st discovered th at selec tors 
|the United States | 


The selectors were detasked! 


TOP SECRET//SI/T.\I.E \T KEYHOI.E//\OFORN 
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(TS//SI VRCL TO USA. r\TY) | I it was discovered that | | 

selectors for a foreign intelligence target had been overlooked when other selectors tasked under 
FAA §702 authority were detasked because of the target's U.S. travel. All selectors were 
detasked. and non-complian t FAA §702 data has been marked for purging . It was also 
discovere d that the selectors! |in a raw traffic 

f U f database. | |and the selectors were removed | 

) (3) -P. L. 86-36. . 


delay s in detasking the selectors for a foreign intelligence target who had entered the United 
Statesl " " | 

| | The selectors were detasked and no data was collected. 

(S//SI//RCL TO USA. rVCY ) | | an analyst learned that a selector for 

a foreign intelligen ce target had remained on task even though information was known on _ 

| | about the target’s U.S. travel. The selector was detasked 

No collection occurred. 


(E'rm. 

(b)(3)-P.L 


(3//SI//RCL TO USA - FVE"¥ )| _| selectors for foreign 

intelligence targets were discovered to have remained on task, even though related selectors had 
been detasked because the targets were in the United States. Upon discovery, the selectors were 
detasked 

..86-36 . .. —.--- 

(S//S1//REL TO USA. rVE ¥ H I an analy st discovered thaj | 

valid foreign intelligence targets had traveled to the United States from! 

Although information was available_ 


pn th e forwarding of the information. 

Upon discovery of the information | | the analyst initiated the detasking. 

Collection was deleted, and no reporting occurred. (b) (l) 

(b) (3)-P.L. 86-36 

I a o /i |\| I (b) (3)-18 use 798 

-1 (b) (3) - 50 USC 3024 (i) 



I.A.3 (U) Unauthorized Access 


Colorado (NSAC) that approxim ately 
or training, had had access to the I 


.(b) (1) 

(b) (3)-P.L. 86-36 


_| it was discovered at NSA/CSS 

rersonnel. not all of whom had the proper authority 



(b)(1) 

(b)(3J-P.L. 86-36 
(b)(3)-50 USC 3024(i) 
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(b)(1) 

(b)(3)-P.L. 86-36 
(b) (3)-50 USC 3024 (i) 


(b)(3)- 


(b) (1). 

(b) (37- 



data sources to ensure that raw SIGINT is being handled properly. 
?.L.86-36 


JNSAC has begun an in-depth review of all raw SIGINT 


(U//EOUO) 


it was discovered that raw SIGINT data was stored 


on a server not authorized to hold it. The data was deleted and moved to an authorized location. 
A listing of authorized servers has been compiled to prevent future errors. 


I.A.4 (U) Data-Handling Error 

(TS//SI//REL TO USA. - f ¥E¥t r 
unauthorized recipients that included the identities of USPs. The e-mail was immediately 
recalled. 


jail analyst forwarded an e-mail to 


P.L. 86-3 6(S//SI//NF » J . | an analyst forwarded in an e-mail to unauthorized 

recipients the results of a raw traffic database query that included terms associated with a USP. 


The e-mail was recalled the same day. 


(C7/SI//NF) 


NSA issued a memorandum that erroneous! 


?b)(1) 


contained a USP identity. The memorandum was immediately recalled. (b)( 3 )-p L 86-36 

USP information was inadvertently released as part 


[ 


(TS//SI//NF) 


data. The recipient has submitted a request for evaluated minimized traffic. 


Jwere not vetted for possible USP 


(TS//SI//REL TO USA. FVEY) 


USP information was released to 


unauthorized recipients in a chat room The information was recalled, and the recipients were 
instructed to destroy all copies. 


t TS/TiU RCL TO USA. rVTV [ 


an NSA analyst provided a file 


containing raw SIGINT to an 1C an alyst who was not authorized to receive it. Upon discovery of 
his mistake } - 


(TQ//G1//RCL TO USA. P VC TT,_ _ 

identity of a U S. entity had not been masked in traffic passedj 
was canceled, properly minimized, and reissued^" 


the NSA analyst instructed the IC analyst to delete the file. 

an analyst discover ed that the 
The traffic 


purged the traffic containing the unmasked U.S. identity. To prevent a recurrence. 


I.A.5 (U) Systems Error 

~r rs si m~) | 


<b) (1) 

(b)(3)-P.L. 86-36 


[ 


it was discovered that a system [ 


without sufficient 


TOP SECRETVSLT. 1/.DT KEYIIOl.E//\()rt)R.r 


1 
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(b) (1) 

(b) (3)-P.L. 86-36 
(b) (3)-50 USC 3024(i) 


( 1 ) 
(3) - 


(b) (1) 
(b) (3) 


TOP SECRET/j'ShT. U.EXT KEYHOI.EffSOrORS 


docume ntation reeardinu the sys tem's procedures for data ingest, age-off. or purge. Information 


gathered 


[ 


indicated that the data retained in the system included 

| Efforts to 


identity the scope of the problem, as well as solutions, are ongoing. 
P.L. 86-36 

I B. (U) Foreign Intelligence Surveillance Act (FISA) 




Some incidents may involve more than one authority (e g.. E.O 12: 
NSA/CSS Title 1 FISA. FAA ). Incidents involving more than one authority are included in the 
section for each involved authority. Thus, a single incident may produce multiple entries in this 
report. 


(U//E QUO ) Incidents of non-compliance with any authority or approval granted by the 
Foreign Intelligence Surveillance Court (FISC) are reported to the FISC, the Department of 
Justice, and the Office of the Director of National Intelligence. 

I.B.1. (U) NSA/CSS Title I FISA 


I.B.I.a. (U) Detasking Delays 


■f FS//SI//Nr) [ 


disc overed that selectors for foreign intelligence targets had not been de tasked 


r 


? 


analysts 


] All selectors have 


been detasked. and non-compliant data has been marked for purging. 

| an analyst discovered that a selector associated 
Iliad been mistakenly inclu ded on a renewal of 


(TS//SI//N F) | 

with a previousl y FI SC-approved tametT 
the Court Order | 


I.B.I.b. (U) Unauthorized Targeting 


(b)(1) 

(b)(3)-P.L. 86-36 


(T3//S1//NF) 


an analyst discovered that communications 


collected pursuant to FISA authority did not belong to the FISC-approved target The selector 
used to target the communications was detasked and non-compliant data was marked for 
purging. 


(TS//S1//ND 



Data collected from the selector has been requested to be purged. 

an analyst learned that [_ 


(TS//SI//NF) 


compliant data was marked for purging. 


] had been using the telephone number for a 
The telephone selector was detasked. and non- 


-P.L. 86-36 


(b)(1) 

(b)(3J-P.L. 86-36 
(b)(3)-18 USC 798 
(b)(3)-50 USC 3024(i) 


TOP SECRETZ/SL'T. U.E.XT KEYHOI.E//\OFOR\ 
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(b) (1) 

(b) (3)-P.L. 86-36 
(b) (3)-18 USC 798 


~t TS//SI//Nr) 


an analyst di scovered that a tasked telephone selector 


was associated with a U S. entity. The data was purged 
(TG//3I//NQ 


target | 

Ti l )' : was detasked I 
)(3)-P.L. 86-36 


_ > an analyst discovered that collection occurring 

Ion a cellular telephone selector associated with a FI SC -approved 

The selector 


J 


1 'T Si ' S 1/7'NT { 


authorized for collection under a FISC Orderf 


it was discovered that a cellular telephone number 

i 


| The selector was detaskedl 
requested to be purged I 


land non-compliant data wa~ 


I.B1.C. (U) Database Queries 


(TS//S I //N F) 


] an analyst performed a query in a raw traffic 


database on the selectors associated with a target after it had been determined that the target was 
no longer considered to be an agent of a foreign power. Non-compliant data was marked for 
purging. 

...- /ib) (1) 

I.B.I.d. (U) Data-Handling Errors <b)<3)-p.L. 86-36 


(TS/ /9 I //N F) f 
handlin'! of| 


while investigating an incident of improper 
J NSA discovered that analysts in various organizations 


were not handling Title I FISA data properly. NSA provided remedial training to analysts who 
access Title I FISA data. 


(S//SI//REL TO USA. FVEY)| an analyst 

' 

discovered that[ | 



1 .. . 1 


of the problem and the steps to mitigate the incidents is ongoing. 
I.B.2. (G//R t rL TO USA, FV EY) | 


(U) Nothing to report. 

I.B.3. (TS//S I //NF ) Business Records (BR) Order 
I.B.3.a. (U) Data-Handling Error 


4TS//SI//NF) 


(b)(1) 

(b)(3)-P.L. 86-36 
(b) (3)-50 USC 3024 (i) 


it was disc overed t hat metad&^ (1) 

- T^(3)-P.L. 86-36 


counterpart 


obtained under the FISA BR Court Order had been released in an e-mail 
without required approval. The personnel involved were counseled on the proper dissemination 
procedures. Ultimately, the required approval was obtained, and. therefore, the e-mail was not 
recalled. 


TOP SECRET//SL / T. if.E.\T KEYHOI.E//\OrOR.\ 
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fb)(1) 

(b)(3) - 


(b)(1) 
(b) (3) 
(b) (3) 


I.B.4. (U) FISA Amendments Act (FAA) 

(U/ /FOUO) Some incidents may involve more than one authority (e g. E.O 12333. 
NSA/CSS Title I FISA. FAA). Incidents involving more than one authority are included in the 
section for each involved authority. Thus, a single incident may produce multiple entries in this 
report. 

I.B.4.a. (U) FAA Section 702 <b) (3) " p - 

(U / / FOUO) NSA/CSS has implemented a process to ensure that F AA §702 data 
required to be purged is purged from NSA/CSS databases. NSA created af~ I 

| to identify non- 

compliant data that should be purged. 


I.B.4.a.i. (U) Tasking Errors 

(TS//S1//REL TO USA. FV'C T) On[~~|occasions during the fourth quarter, selectors 
were incorrectly tasked because of typographical errors. The selectors were detasked. and the 
information has been purged. No reports were issued 

(TS//S 1 //REL TO USA. FVEY) On | | occasions, it was discovered that a selector had 

been tasked in error because the target did not meet the criteria of an FAA §702 certification. 

The selectors have been detasked. and the non-compliant data has been purged No reports were 
issued. 


(TG//G1//RCL TO USA. rVE¥) [ 


had been erroneously tasked because information received[ 


it was discovered that a selector 

I about the target’s 

USP status had not been passed to the anal yst before the selector w as approved for tasking. In 


addition, the selector had remained on task 
which analyst would submit the detask request, 
purging, and no reports vvere issued. 


because of confusion about 
All non-compliant data has been marked for 


(TS//31//REL TO USA. FVE T 7 J 
selector tasked under the FAA §702 \ 
tasked under the£ 


and all non-compliant data was marked for purging. 


Jcertification. The selector was detasked 


an analyst discovered that a 
Jcertification should have been 


P-L. 86-3 <i(ts//SI//REL T O USA. EVEY) f 
was erroneously tasked 


it was discovered that a selector 
Upon discovery, the selector was immediately 


detasked The non-compliant data was marked for purging. 


(T0//SI//N F) 


it was discovered that a selector had been retasked 


in error because an analyst had not followed proper tasking procedures. The selector had been 
detaskedl ~ 


data has been marked for purging. 


J The selector was detask ed 


Non-compliant 


-P.L. 86-36 
-18 USC 798 


TOP SECRET//SI/T. I/.EAT KEYHOID'/SOrORS 
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(TS//S1//RCL TO USA, rVCV) |_it was discovered that a selector 

associated with a valid foreign intelligence target had been erroneously tasked because of a 
typographical error. Believed to be associated with a USP. the incorrect selector had been 
detasked. and non-compliant data has been marked for purging. 


) ( 1 ) 
) (3) 


(TS//SI/7REL TO USA. FVEY) |_| an analyst learned that a selector 

had been erroneously tasked because an 1C ag ency analyst had passed an incorrect selector. The 
selector was detasked f | and non-compliant data has been marked for 

purging. 


-P.L. 86-3 


TTS//SI//NF) ! I an analyst discovered |_ | that 

a valid foreign intelligence target had been in communications with another person, while both 

were located in the United States. All non-compliant data associated with the donte&tid-) 

communication was purged, and no reports were issued. j£j - 5 o L {jsc 6 3024 (i) 

"f P Sy/SlZ/RCL TO USA. F\TV) On | | occasions. an analyst tasked a selector believed 
to be associated with a valid foreign intelligence target, but after tasking, the analyst received 
proof that the target was either a USP or not the intended target In each situation, the selector 
was detasked and the non-compliant data was purged. 

.. ( 1 ) 

, n .. . . _ .. .^S***" (b)(3)—P.L. 86-36 

I.B.4.a.ii. (U) Unauthorized Targeting 


occurred on e-mail accounts 


)n | b ccasions during the founh quarter, collection 
Ithe United States! 


| (Also included are occasions when| 
States could not be confirmed.) 

I.B.4.a.iii. (U) Database Queries 


Jthe United 

'(b) (1) 

(b) (3)-P.L. 86-36 


(TS//SI//REL TO USA. F'VEY) On| loccasions during the fourth quarter, analysts 
performed in FAA $702 data overly broad or poorly constructed database queries that potentia ly 
selected or returned information about USPs. These queries used| 

Hthat produced imprecise results. 


an analyst performed a query in an FAA $702 raw traffic database using selectors associated 
with a USP target approved under FAA $705(b) authority. The queries were not performed in 
accordance with NSA internal procedures. The query and the results were deleted. 

(TS/7S I /7ROU - TO ' US A. FVPY) | | an an alyst learned that a selector 

associated with a valid foreign intelligence target had remained taske d! 

| while the target was in the United States from| | 

| by a second 

analy st, upon learning of the target's visit. At that time, however, the second analyst was not 
aware I I 


(b) (1) 

(b)(3J-P.L. 86-36 
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(b) (1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 USC 3024(i) 


The first analyst immediately detasked the selector £ 


]and deleted the query 


and the results the following day. Both analysts were counseled on the proper procedures for 
ensuring that all selectors associated with a target are detasked. 


(TS SI REL TO UG A. r\T¥ lf 

had performed a query in an | 


_| an auditor discovered that an analyst 

J>f a raw traffic database on a selector known to 


be a USP. Upon being told of the mistake, the analyst immediately deleted the query and the 

results. .. (b) (l) 

(b) (3)-P.L. 86-36 

(TS//SI//REL TO USA. FVEY) | an analyst mistakenly queried on a 

selector associated with a USP as a result of not being familiar with the new functionality 
provided by the query form. The analyst realized her mistake immediately and deleted the query 
and the results. 


(TS//S1//NF) 1 


]analysts performed queries on 


selectors associated with a USP in a raw traffic database without conducting the necessary 
research on the selectors. The queries and the results were deleted 


(TS//S1/ REL TO USA. FV EXf 


discovered that| [selectors associated with| | valid foreign intelligence target shad 

~| while the target was in the United States. 


it was 


the analyst had detas ked the selector| 

All results have been deleted 


i 


(TS SI REL TO USA. EV E^f 


(b) (3)-P.L. 86-36 

an auditor discovered that, on 
uery in an FAA 


£702 raw traffic data base using | [ selectors associated with a known USP. _ _ _ _ 

'the query and the results were deleted. No reports were issued. J \\ _ 



(TS//S 1 / REL T O USA. E¥ fc¥)[ 


(b) (3)-P.L. 86-36 
] an analyst discovered □ 


__Jselectors associated w ith an individual who was not the intended target 

and who had traveled to the United States. CD selector that was correctly associated with the 
intended target was queried when the target was in the United States. - (b) (1) 

(bj (3.) -P.L. 86-36 

I.B.4.a.iv (U) Detasking Delays (b) (3)-so use 3024 (i) 




it was discovered that P 


cau sin» a delay in detasking of up to 24 hours on some requests __ 

I detask selectors immediately upon request. 


J potentially" 


■ (TSTSI//Nr) | " 


it was discovered tliatf 


Upon discovery of the error, the selectors were 


immediately detasked and the non-compliant data was marked for purging. 
) (3)-P.L- 86 ~3 5(ts i /si/VREL TO USA. FVEY) | 


Jit was discovered that 


selectors associated with valid foreign intelligence targets had remained on task while the targets 
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tb)(1) 
(b) (3)"- 


were in the United States. 


[the targets were in the United States. The selectors were 
detasked and all non-compliant data were marked for purging. 


(T!v SI " Rfl. TO USA. f¥ fe¥l[ 


it was discovered that 


]the foreign intelligence 


target selector had remained on task while the target was in the United States. The selector was 
detask ed^ 


been marked for purging. 

EVl,. 86-36 


■ (TSf ' SURCL TO USA. f\TV) [ 


] Non-compliant data has 
it was discovered that | [ selectors 


associatedwith a foreign intelligence target had remained on task while the target was in the 


United States from£ 


The delay occurred because a junior 


analyst was unaware of the detaskin g procedures. The selectors were not detasked because the 
target returned to a foreign location | | All non-compliant data from 


]has been marked for purging. 


] 


_ - (TS//SWREL TO U SA. P rfc¥t | 1 

l it was discovered that l [ selectors associated with valid foreign intelligence targets had 
remained on task when the targets arrived in the United States. On each occasion, the analyst 


compliant data was purged, ino reports were 

(TS//01//REL T - O - USA. rV E ¥t l~ I it 

was discovered that selectors associated with | lyalid foreign intelligence targets had remained 
on task when the targets were in the United States | 

| | The selectors were 

detasked upon discovery ottlie incidents, and all non-compliant data was purged No reports 
were issued. 


I'he selectors were detasked. and all non- . 
‘ issued 


(b) (1) 

(b)(3)-P.L. 


86-36 


tT 3//3l//REL TO USA. f\TY) [ 


it was discovered that a selector 


associated with a valid foreign intelligence target had remained on task while the target was in 
the United States. [ 


compliant data was purged. 


All non- 

' (b) (1) 

(b) (3)-P.L. 


86-36 


T TS; 'S1//REL TO USA. r\TV) [ 


an analyst discovered that a 


selector associated with a v alid foreign intelligence target had remained on task when the target 

arrived in the United States|_ The ana lyst believed that he had d etasked 

the selector at that time, but it actually had remained on task_ All non- 

compliant data was purged, and no reports were issued 


(TS//SI//REL TO USA. f\'EY) | I it was discovered that a selector 

associated with a valid foreign intelligence target had remained on task while the target was in 
the United States from | | The selector remained tasked because the 

target had returned to a foreign location. The non-compliant data was purged. 
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(TS//SI//REL TO USA. F¥EY) | I an analyst discovered that a 

selector associated with a vali d foreign intelligence target had re mained on task when the target 
visited the United States fro ml I When th e analyst was origina lly 

notified that | | his target was in the United States l I the 

analyst initiat ed a detasking. but the H etasking was not executed. When the analyst was notified 
a second time | I that the target was located in the United States, the selector 

was immediately detasked. All non-compliant data was purged. "(b) (l) 


(b) (3)-P. 


(TS//Sl//Nr) 

NSA analysts discovered that a selector had 

remained on task because of a software error 


1 __ 

| The system error was corrected 

_ 


Non-compliant data has been marked for purging 


ru; si ru:L. to usa. rvcv ) 


it was 


discovered that □ 


selectors associated with l I valid foreign intelligence targets had remained on task while the 
target was in the United States. The selectors were detasked and the non-compliant data was 
purged. 


(T0//01//N f-)[ 


I an analyst discovered that | [ selectors (l) 
associated with a valid foreign intelligence target had rem ained on task while the target vJIs' <3) ~ p ' 
visiting the United S tates from | | The analyst was aware on 

I ~| that the target was in the Un ited States and believed that the selectors had 

been detasked that day. 1 I the analyst realized that the selectors had not 

been detasked but did not request the selectors to be detasked at that time because the target had 
returned to a foreign location. All non-compliant data was purged, and no reports were issued. 


(TS//S1//REL TO USA. FVEY) I "Ian analyst discovered thaP>> U> 

collection had occurred o 
visit inn the United States. 


| the selectors were detasked and the non-compliant data was purged. No 

reports were issued 


ill Iselectors associated with a valid foreign intelligence target' 

i (3) 

J_ 



The collection occurred because the 


-p 


(TS-S l -RH. TOTJSA. rVE ’ Y l l I an analyst discovered that I I 

selectors associated with a valid foreign intelligence target had remained on task when the target 

was in the United St ates. _ 

_ resulting in collection of the target while in the United States. The selectors 

were detasked and the non-compliant data was purged. (b) (1) 

._. .. (b) (3) -P. L. 

HS -- S 1-- REL TO USA. FVE¥) | I it was discovered that a selector 

associated wit h valid foreign intelligence target had remained on task while the target was in the 
United States. | 

m ie selectors were not detasked 
because the target had returned to a foreign location. All non-compliant data has been marked 
for purging. 


L. 86-36 


•L. 86-36 


.L. 86-36 


86-36 
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fT 3//SI//REL TO UGA. fYEY) 


it was discovered that selectors 


associated with va lid foreign intelligence targets had remained on task while the targets were in 
the United States. I 


All the selectors were detasked. and the non-compliant data was marked for 


purging. 

I.B.4.a.v. (U) Data-Handling Errors 


'(b)(1) 

(b)(3)-P.L. 86-36 


(TS " SI " RF1. TO USA. FVEY) 


an analyst sent an e-mail, which 
included an attachment with FAA §702 data, to an 1C analyst not authorized to receive it. Upon 
discovery, the recipient deleted the e-mail without opening the attachment. The analyst was 
counseled on proper data-handling procedures. 


(TS/.'SI.'.'REL TO USA. fVC ¥t[ 


an analyst sent an e-mail, which 
included an attachment with FAA §702 data, to three analysts not authorized to receive it. Upon 
discovery, the recipients deleted the e-mail and the file to which the information was 
downloaded. 


T TS//31//RCL TO USA. FV E Y) I _ _|t was discovered that analysts were 

storing FAA §702 data in directories without controlling access to the information. The analysts 
were using outdated guidance and were unaware of the proper procedures for handling FAA 
§702 data. The analysts were informed of the proper procedures, and the data was placed in 
proper directories. 


(TS//SI//REL TO UGA. fYEYt 


an analyst discovered that 


software failed to place FAA §702 data in the proper file directory that would have provided 
access controls. Instead, the placement of the FAA §702 defaulted to a direc tory th at could be 
accessed bv unauthor ized and untrained personnel, although highly unlikely. | | 

[ changes to the software were made to ensure the proper placement of FAA 


§702 data. 


(S'/REL TO USA. FY EV) [ 


it was discovered that. 


Jan analyst had shared FAA §702 data with a second analyst not 


authorized to receive it. Upon discovery, access to the data was discontinued until the second 
analyst received the proper training on handling FAA §702 data 


I.B.4.a.vi. (U) Unauthorized Access 




(b) (1) 
(b) (3) 


-P.L. 86-36 


ET -f- l-SI-RT - L - Tf - )T ^A - [ 


| a supervisor discovered that a 

analyst was accessing FAA §702 data from an unauthorized location. The 
analyst was ap proved for FAA §702 data access but then transferred to another location on 
at which time her access should have been terminated. Upon discovery of the 


incident, the analyst’s access to FAA §702 was discontinued. 


(T0//GI//REL IU USA. ElEf T[ 


an analyst discovered that another 
analyst was accessing FA A §702 data from an unauthorized location. The analyst was approved 
for FAA §702 data access | | but then transferred to another location in 
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_| at which time her access should have been terminated. Upon discovery of the 

incident, the analyst’s access to FAA $702 was discontinued. 


) d) I.B.4.a.vii (U) Systems Error 

) (3)-P.L. 86-36 


't fe) (1) 

(b)(3)—P.L. 86-36 
(b)(3)-50 USC 3024(i) 




I.B.4.b. (U) FAA Section 704 

(U) Section 704 of the FISA provides for the targeting of United States persons located 
outside the United States pursuant to a particularized court order. 

I.B.4.b.i. (U) Detasking Delays 

~(T9//9I//NF) | |it was discovered that selectors for a FAA $704- 

ap proved taraet had remained on task | | 

The selectors were detasked] [ 

.(b)(1) 

I.B.4.C. (U) FAA Section 705(b) (b) (3 )-p.l. 86-36 

(U) Section 705(b) of the FISA provides for the targeting of United States persons 
located outside the United States upon authorization by the Attorney General when court orders 
have been obtained authorizing a physical search or electronic surveil lance. 


I.B.4.c.i. (U) Database Queries 


a database auditor discovered that an analyst had 


performed queries on an FAA $705-approved target 


(b)Tl) 

■+ferH3)-P.L. 86-36 



(T0//0I//?4P) | | an analyst was notified by[_ 

target tasked under FAA $705(b) authority had returned to the United Statesl 


that a 


(b)(1) 

(b)(3)-P.L. 86-36 


(b) (1) 

(b)(3)-P.L. 86-36 
(b) (3)-50 USC 3024 (i) 
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The selector was detasked 


analysts remindedj 
FAA §705(b) targeTs" 


of the necessity to 


] To pr event future detasking delays. NS A 


I.C. (U) Consensual Collection 

(U) Nothing to report. 

I D. (U) Dissemination of U.S. Identities 


(b) (1) 

(b) (3)-P.L. 86-36 


(TS.'. ; Sl//N Ft TheNSA/CSS enterprise issued | I SIG1NT product reports during the 
fourth quarter ofCY2012. In| |product reports, disseminations were found to be improper, and 
the reports were recalled as NSA/CSS and| [analysts learned of USPs. U.S. 

organizations, or U.S. entities named without authorization. All data in the recalled reports was 
deleted as required, and the reports were not re-issued or were re-issued with proper 
minimization. 

I.E. (U) Counterintelligence Activities 

(U) Nothing to report. 

I F. (U) Detection and Prevention of Violations 

(TS//S1//NE) As pre viously reported. NSA has instituted a p rocess to help identity when 
the users of properly tasked ! Ithe United States. NSA’s 

teleph ony process identified ! I 

| [ in the fourth quarter. Collected data was purued from NSA/CSS’s raw traffic repositories . 
NSA's process for| 


] in the fourth quarter. 


(b)(1) 

(b)(3)-P.L. 86-36 


Collected data was purged from NSA/CSS's raw traffic repositories 
I G. (U) Other " (b)( 3 )-p.l. 86-36 

(U/-TOUO) Ir j [ instances, database accesses were not terminated when analysts 
were deployed or reassigned to another site. Although not considered violations ofE.O. 12333 or 
related di rectiv es, the accesses were terminated in accordance wit h NSA policy. In addition, 
there was | l instance of unauthorized access to raw SIGINT and | [ instances of account 
sharing during the quarter. 

II. (U) NSA/CSS Office of the Inspector General (OIG) Intelligence Oversight (10) 
Inspections, Investigations, and Special Studies 

(U//F OUO) During the fourth quarter ofCY2012. the OIG reviewed various NSA/CSS 
intelligence activities to determine whether they had been conducted in accordance with statutes. 
E.O.s. AG-approved procedures, and Department of Defense and internal directives. The 
problems uncovered were routine and the reviews showed that operating elements understand the 
restrictions on NSA/CSS activities. 
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"(b) (3)- 


"(b) (1) 

(b)(3)-P.L. 86-36 
(b) (3)-18 USC 798 
(b)(3)-50 USC 3024(i) 


IIA (Q//RQ- TO U0A.-FVE - ¥ ) [ 


i S • Rl I TO USA r\TY) During the field inspection of_ 

_ an 10 inspector reviewed 10 program management. 


* _ ~a 


personnel assigned to the site, and procedures for ensuring that all site personnel received 
required 10 training. The inspector's overall assessment was that the site had a rudimentary 10 
program that needed further documentation and development. The 01G recommended that the 
site document its 10 processes and procedures and conduct informal 10 training sessions for site 


personnel 


II.B. (U) Special Study of the Research Directorate’s (RD) Compliance Program 


p 


(U//FOUO) The NSA OIG summa rized the results of a r eview of the NSA RD’s ( _ 

Compliance Program in a rep ort published ! The review, conducted _ 

J focused on the operation of the program by the Directorate's 10 


component. The review identified two areas of improvement for the 10 compliance program: 
program documentation and enhanced controls to monitor 10 training compliance for the RD 
workforce. 


II.C. (U) Special Study: 

.L. 86-36 


Assessment of Management Controls Over FAA §702 


(U/ /FOUO) The NSA OIG reported the results of a review of the management controls 
implemen ted to provide reasonab le assurance of compliance with FAA §702. The report, 
published | [ identified one instance of non-compliance and included 

recommendations to improve the overall control environment in which FAA §702 authority is 
exerciser!. Information received after the report's issuance that had not been made available to 
the OIG during the initial review indicated that there had been no instance of non-compliance 
and that the control procedures are designed to comply with FAA §702. 


II.D. (U) Advisory Report on 


Compliance with NSA/CSS Authorities 


(u/r rouo H 


] the NSA OIG conducted a review of 


a technology demon stration that uses cloud computing. In an advisory r eport publish ed 


]the OIG found that controls on data ingestion and on[ 


rO 


1 particip ants 


required manual implementation to comply with NSA/CSS authorities, leaving 
compliance measures vulnerable to hum an error. Fur thermore, these controls were not 
sustainable outside the tightly controlled f ~| environmcnt 


E. (U) Ongoing Studies 


(b)(3)-P.L. 86-36 


(U/ /FOUO ) The following special studies were initiated during the quarter and will be 
summarized in subsequent quarterly reports: 

• (U/ /r0t f6) FAA §702 | 

• (U) Special Study: Assessment of Man agement Controls Over FAA §702 - Revision 

• (U) Special Study o fl ~| Auditing Control Framework for Signals 

Intelligence System Queries 
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(U) Special Study of the 


(b)(3)-P.L. 86-36 


System 


(U) Special Study of the Technology Directorate Mission Compliance Program 
(U) Special Study of the Information Assurance Directorate Office of Oversight and 
Compliance Mission Compliance Program 


F. (U) Misuse of the U.S. SIGINT System 


(U) Nothing to report 

I.G. (U) Congressional and 10 Board Notifications 


(S//SI//NF) 


NSA notified the Congressional intelligence 


(b)(1) 

(b) O)-p.: 


committees about a Title I FISA compliance incident involving the misapplication of certain 
provisions of NSA’s minimization procedures. After learning of one instance in which domestic 
communications encountered in the course of authorized collection had not been handled as 
required, senior NSA managers initiated a lull-scale review. Although the review is ongoing, 
they have learned that there was no indication of willful non-compliance of minimization 
procedures; personnel seem to have misapplied those procedures. Retraining sessions are 
ongoing. 


II H. (U) Other Notifications 


(TS//S I //NF) The AG granted NSA/CSS approval for | [ intelligence-related collection 
activities associated with USP hostage and detainee cases. 

(b)(1) 

III. (U) Substantive Changes to the NSA/CSS 10 Program (b) (3 )-p.l. 86-36 


A. (U) 


(UATOUOf As reported in the Second Quarter CY2011 report. NSA/CSS is developing a 
tool designed to automate the process of submi tting mission compliance incident reports across 
the worldwide NSA/CSS enterprise. The | | will become the Agency’s central tool for (p) (3)-p 
reporting all potential mission compliance incidents and will provide such benefits as a 
streamlined management process, a c entral repository, and metrics data t o support root caus e 
identification and trend analysis. The I I is expected to be implemented I I With 


naiysi : 

the implementation of the | [ NSA will be able to perform comprehensi ve trend analysis 


IV. (U) Changes to NSA/CSS Published Directives or Policies Concerning 
Intelligence, Counterintelligence, or Intelligence-Related Activities and the 
Reason for the Changes 


(U) Nothing to report. 

V. (U) Procedures Governing the Activities of DoD Intelligence Components that 
Affect USP (DoD Directive 5240.1-R, Procedure 15) Inquiries or Matters Related to 
10 Programs 


. 86-36 


.L. 86-36 
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(U) Nothing to report. 

VI. (U) Crimes Reporting 

.? :, 'Xb) (1) 

(U) Nothing to Report (b) ( 3)-50 use 3024 (i) 

VII. (U) Other Matters 

(S//NH The NSA OIG is continuing its investigation into an allegation reported in the 
Third Quarter CY2012 report that ! " " I 

-f fa//0I//NT) | ... \ 


_| NSA verbally notified the Office of the Assistant to the Secretary of Defense for 

Intelligence Oversight of this issue. 

(U) NSA/CSS has taken the following remedial actions: 


m>.* 

)(3)-P.L. 86-36 


(S//NF) NSA C SS has obtained approval from the Undersecretary of Defense tol¬ 
lmen iirpnpp I-- 


)(3)-50 USC 3024(i) 

•StWF) NSA/CSS is working with thef 


fS /rNf) 


(U/ /FOU O) NSA/CSS does not anticipate that thisj 
lwill have any effect on national security or international relations. 
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